# App messaging can be hijacked by third-party websites

Shopify admin's postMessage origin check used suffix match, so badexample.com passed for app example.com, letting third-party sites spoof app messages and overlay fake login pages.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: palant
- Disclosed: 2018-11-07
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/387279
- Library page: https://bugbountylibrary.com/r/h1%3A387279
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:medium technique:source-review vuln:auth-bypass vuln:misconfiguration

**Target:** Shopify admin JS postMessage listener for embedded apps
**Root cause:** Origin validation compared hostname suffixes without a dot boundary (`t.hostname.slice(-e.hostname.length) === e.hostname`), so any domain ending in the app's hostname (e.g. badexample.com for example.com) was treated as a trusted subdomain.
**Steps:**
1. Install the Trust Badge app (runs from hektorcommerce.com) in a shop.
2. Register/point a lookalike domain `dehektorcommerce.com` at an attacker server with valid TLS.
3. Serve `exploit_app_comm.html` that frames the shop admin and posts a `Shopify.API.Modal.open` message to it.
4. Because the origin check accepts `dehektorcommerce.com` as a subdomain of `hektorcommerce.com`, the admin accepts the message.
5. The admin interface is overlaid with an attacker-controlled fake login page; entered credentials are captured ('Gotcha').
**How found:** Reading the admin bundle's `message` listener, the researcher noticed the origin check delegated to a helper `e` that compared hostname suffixes; realizing suffix matching without a dot boundary admits lookalike domains, they tested with a registered lookalike of a real app's domain.
**Exploitation:** Attacker registers a domain that is a suffix of a victim app's domain, hosts a page that frames the Shopify admin and sends `Shopify.API.Modal.open` (and potentially privileged messages like `Shopify.API.Cart.discount.add`) in the app's name. The admin renders the attacker page as an overlay; since the URL bar shows the real Shopify admin, phishing for credentials is convincing.
**Escalation:** Beyond phishing overlays, the same origin bypass lets third parties send privileged app-only messages such as `Shopify.API.Cart.discount.add`, potentially abusing app privileges.
**Insight:** When auditing postMessage origin checks, look for suffix/`endsWith` hostname comparisons lacking a `.` boundary — any registrable domain ending in the trusted hostname passes. Also check whether privileged message types (discounts, modals) rely solely on that origin gate.